package Arcsight::Case;

use strict;
use XML::IODEF;
use Data::Dumper;

sub new {
	my ($class,%parms) = @_;
	my $self = {};
	bless($self,$class);

	$self->details(	$parms{'-details'}) if($parms{'-details'});
	$self->id(	$parms{'-id'}) if($parms{'-id'});
	$self->events(	$parms{'-events'}) if($parms{'-events'});
	return($self);
}

sub id {
	my ($self,$v) = @_;
	$self->{_id} = $v if(defined($v));
	return $self->{_id};
}

sub details {
	my ($self,$v) = @_;
	$self->{_details} = $v if(defined($v));
	return $self->{_details};
}

sub events {
	my ($self,$v) = @_;
	if(defined($v) && uc(ref($v)) eq 'ARCSIGHT::EVENT'){
		$self->{_events}->{$v->id()} = $v;
	}
	return($self->{_events});
}	

sub message {
	my $self = shift;

	# we want to know:
	# origSystem
	# CaseID:
	# EventList:
	# File:
	# Case Timestamp:
	# Estimated Start Timestamp:

	my $msg = "\n";

	$msg .= "System:\t\tArcsight\n";
	$msg .= "CaseID:\t\t".$self->id()."\n";
	$msg .= "Events:\t\t";
	foreach my $event (keys %{$self->events()}){
		$msg .= $event.',';
	}
	$msg =~ s/,$/\n/;
	$msg .= "File:\t\t".$self->details()->{'name'}."\n";
	$msg .= "Case Timestamp:\t".$self->details()->{'detectionTime'}."\n";
	$msg .= "Est Start Time:\t".$self->details()->{'estimatedStartTime'}."\n";

	foreach my $event (keys %{$self->events()}){
		$msg .= "\n";
		$msg .= $self->events()->{$event}->message();
	}

	return $msg;
}

1;
